Security and Privacy
MORATUS has no passwords: you sign in with your Google account or with a secure link sent to your email. Since there's no MORATUS password that could leak or be reused on other sites, your account's security rests on the security of the Google or email account you sign in with.
- Sign-in uses OAuth 2.0 and PKCE. PKCE prevents the authorization code created during sign-in from being used outside the app that started the flow.
- Active sessions are listed with device, location, and sign-in time, and can be closed one by one.
- Desktop Because the PKCE verifier exists only in the app window that started the flow, a fake
moratus://link opened from outside cannot open a session. - Mobile The session is stored in the device's secure key store (iOS Keychain).
Sign-in by platform
| Platform | Sign-in |
|---|---|
| Web | In the browser, with Google or an email link |
| Desktop | In the system browser; the session returns to the app through a moratus:// link, and the browser asks for confirmation the first time |
| Mobile | In a secure browser session inside the app; the session returns to the app through moratus:// |
Sign in with Apple is coming soon. For the sign-in steps on each platform, see Sign-in flow by platform.
Keeping your account safe
- Protect the Google or email account you sign in with using two-step verification; anyone who can access it can also sign in to MORATUS.
- Don't share the sign-in link sent to your email, and don't click a sign-in link you didn't request.
- On a shared device, sign out from the account menu when you're done.
- Review Settings > Account > Active Sessions regularly and close sessions you don't recognize.
- Your account credentials are personal; don't share your account. For teams, each member gets their own seat (see Team plan).
If you suspect unauthorized access
- Close every session you don't recognize in Settings > Account > Active Sessions.
- Secure the Google or email account you sign in with: change its password and turn on two-step verification.
- Check the connected apps on the Connectors page and remove any connection you don't recognize (see Disconnecting).
- Report it to support@moratus.ai without delay.